sr-users March 2021

sr-users@lists.kamailio.org

61 participants
68 discussions

Best way to ignore HTTP requests
by Ben Kaufman 11 Mar '21

11 Mar '21

I've set up a server listening on TCP recently, and notice that I'm receiving intermittent, random HTTP requests from the internet. While it would probably be a good idea to enforce a firewall rule to only allow known hosts to communicate, what would be the best way within Kamailio to ignore http requests? Would just checking $rP work? Regards, Ben Kaufman ben.kaufman(a)altigen.com<mailto:ben.kaufman@altigen.com> Director of Cloud Operations AltiGen Communications, Inc.

3 4

Kamailio how to make UAC challenge on Dispatcher failure route
by Antonio Couto 10 Mar '21

10 Mar '21

I have one Kamailio that makes an outbound register on two Asterisk. I have a dispatcher with that same two Asterisk destinations, on INVITE message I call replace_from("", ) in order to call a internal extension and on failure route I receive 401 and call the process of authorization is OK. The problem is that if the first Asterisk fail and I get 500 on failure route I can not call replace_from() because is not valid on the block. Is there any way to make this type of authorization process after receiving a 500 on failure route of dispatcher ? Below my cfg file. Thanks in advance. Antonio Couto #!KAMAILIO#!ifdef WITH_DEBUG#!define DBGLEVEL 3#!else#!define DBGLEVEL 2#!endif # - flags# FLT_ - per transaction (message) flags# FLB_ - per branch flags#!define FLT_ACC 1#!define FLT_ACCMISSED 2#!define FLT_ACCFAILED 3#!define FLT_NATS 5 #!define FLB_NATB 6#!define FLB_NATSIPPING 7 ####### Global Parameters ######### /* LOG Levels: 3=DBG, 2=INFO, 1=NOTICE, 0=WARN, -1=ERR, ... */ debug=DBGLEVEL /* set to 'yes' to print log messages to terminal or use '-E' cli option */log_stderror=no memdbg=5 memlog=5 log_facility=LOG_LOCAL0log_prefix="{$mt $hdr(CSeq) $ci} " children=8 auto_aliases=noenable_tls=noenable_sctp=no tcp_accept_no_cl=yes # SIP port listen=udp:192.168.0.201:5060# xhttp port listen=tcp:127.0.0.1:8181 loadmodule "xhttp.so" loadmodule "jsonrpcs.so" loadmodule "kex.so" loadmodule "corex.so" loadmodule "tm.so" loadmodule "tmx.so" loadmodule "sl.so" loadmodule "rr.so" loadmodule "pv.so" loadmodule "maxfwd.so" loadmodule "textops.so" loadmodule "siputils.so" loadmodule "xlog.so" loadmodule "sanity.so" loadmodule "ctl.so" loadmodule "acc.so" loadmodule "dispatcher.so" loadmodule "htable.so" loadmodule "db_text.so" loadmodule "dialog.so" loadmodule "uac.so" # ----------------- setting module-specific parameters --------------- # ----- jsonrpcs params ----- modparam("jsonrpcs", "pretty_format", 1) modparam("jsonrpcs", "transport", 1) # ----- sanity params ----- modparam("sanity", "autodrop", 0) # ----- tm params -----# default retransmission timeout: 2sec modparam("tm", "fr_timer", 1500)# default invite retransmission timeout after 1xx: 40sec modparam("tm", "fr_inv_timer", 40000) # ----- rr params -----# set next param to 1 to add value to ;lr param (helps with some UAs) modparam("rr", "enable_full_lr", 0) modparam("rr", "append_fromtag", 1) # account triggers (flags) modparam("acc", "log_flag", FLT_ACC) modparam("acc", "failed_transaction_flag", FLT_ACCFAILED) modparam("acc", "log_extra", "src_user=$fU;src_domain=$fd;src_ip=$si;" "dst_ouser=$tU;dst_user=$rU;dst_domain=$rd") # ----- dispatcher params ----- modparam("dispatcher", "list_file", "/etc/kamailio/dispatcher.list") modparam("dispatcher", "flags", 2) modparam("dispatcher", "xavp_dst", "_dsdst_") modparam("dispatcher", "xavp_ctx", "_dsctx_") modparam("dispatcher", "ds_ping_method", "OPTIONS") modparam("dispatcher", "ds_ping_from", "sip:proxy@kamailio.org") modparam("dispatcher", "ds_ping_interval", 1) modparam("dispatcher", "ds_probing_mode", 1) modparam("dispatcher", "ds_probing_threshold", 1) modparam("dispatcher", "ds_inactive_threshold", 1) modparam("dispatcher", "ds_timer_mode", 1) modparam("db_text", "db_mode", 1) modparam("db_text", "emptystring", 1) modparam("dialog", "dlg_flag", 4) modparam("dialog", "track_cseq_updates", 1) modparam("uac", "restore_dlg", 1) modparam("uac", "reg_db_url", "text:///etc/kamailio/dbtext") modparam("uac", "reg_db_table", "uacreg") modparam("uac", "reg_timer_interval", 60) modparam("uac", "reg_retry_interval", 60) modparam("uac", "reg_contact_addr", "192.168.0.201:5060") modparam("uac","auth_username_avp","$avp(auser)") modparam("uac","auth_password_avp","$avp(apass)") modparam("uac","auth_realm_avp","$avp(arealm)") ####### Routing Logic ######## # main request routing logic request_route { # per request initial checks route(REQINIT); # CANCEL processing if (is_method("CANCEL")) { if (t_check_trans()) { route(RELAY); } exit; } # handle retransmissions if (!is_method("ACK")) { if(t_precheck_trans()) { t_check_trans(); exit; } t_check_trans(); } # handle requests within SIP dialogs route(WITHINDLG); # record routing for dialog forming requests (in case they are routed) # - remove preloaded route headers remove_hf("Route"); if (is_method("INVITE|SUBSCRIBE")) { record_route(); } # account only INVITEs if (is_method("INVITE")) { setflag(FLT_ACC); # do accounting } if ($rU==$null) { # request with no Username in RURI sl_send_reply("484","Address Incomplete"); exit; } # dispatch destinations if (is_method("INVITE")) { route(DISPATCH); } else { sl_send_reply("501","Not Implemented"); exit; } } # Dispatch requests route[DISPATCH] { if ($si == "192.168.0.44" and $sp == 5060) { xlog("L_ALERT","from switch $si:$sp)\n"); $var(groupid) = "2"; } else{ xlog("L_ALERT","from others $si:$sp)\n"); $var(groupid) = "1"; } if(!ds_select_dst($var(groupid), "11")) { send_reply("503", "Service Unavailable"); exit; } if ($du =~ "192.168.0.210") { xlog("L_ALERT", "SCRIPT: uac_replace_from\n"); uac_replace_from("", "sip:4000@192.168.0.201:5060"); } xlog("L_ALERT", "SCRIPT: going to <$ru> via <$du> (attrs: $xavp(_dsdst_=>attrs))\n"); t_on_failure("RTF_DISPATCH"); route(RELAY); exit; } failure_route[RTF_DISPATCH] { $var(ts) = t_get_status_code(); xlog("L_ALERT","ALERT: failure_route[RTF_DISPATCH]] from $si:$rp status:$var(ts)\n"); if (t_is_canceled()) { exit; } if(t_check_status("401|407")) { $avp(auser) = "4000"; $avp(apass) = "1234"; $avp(arealm) = "asterisk"; if (uac_auth()) { route(RELAY); } exit; } if (t_check_status("500") or (t_branch_timeout() and !t_branch_replied())) { if (ds_next_dst()) { xlog("L_ALERT", "retrying to <$ru> via <$du> (attrs: $xavp(_dsdst_=>attrs))\n"); t_on_failure("RTF_DISPATCH"); route(RELAY); exit; } } } # Per SIP request initial checks route[REQINIT] { if($ua =~ "friendly|scanner|sipcli|sipvicious|VaxSIPUserAgent") { # silent drop for scanners - uncomment next line if want to reply # sl_send_reply("200", "OK"); exit; } if (!mf_process_maxfwd_header("10")) { sl_send_reply("483","Too Many Hops"); exit; } if(is_method("OPTIONS") && uri==myself && $rU==$null) { sl_send_reply("200","Keepalive"); exit; } if(!sanity_check("17895", "7")) { xlog("Malformed SIP request from $si:$sp\n"); exit; } } # Handle requests within SIP dialogs route[WITHINDLG] { if (!has_totag()) { return; } # sequential request withing a dialog should # take the path determined by record-routing if (loose_route()) { if (is_method("BYE")) { setflag(FLT_ACC); # do accounting ... setflag(FLT_ACCFAILED); # ... even if the transaction fails } route(RELAY); exit; } if (is_method("ACK")) { if (t_check_trans()) { # no loose-route, but stateful ACK; # must be an ACK after a 487 # or e.g. 404 from upstream server route(RELAY); exit; } else { # ACK without matching transaction ... ignore and discard exit; } } sl_send_reply("500","Server Internal Error"); exit; } # Wrapper for relaying requests route[RELAY] { # enable additional event routes for forwarded requests # - serial forking, RTP relaying handling, a.s.o. if (is_method("INVITE|BYE|SUBSCRIBE|UPDATE")) { if(!t_is_set("branch_route")) t_on_branch("MANAGE_BRANCH"); } if (is_method("INVITE|SUBSCRIBE|UPDATE")) { if(!t_is_set("onreply_route")) t_on_reply("MANAGE_REPLY"); } if (is_method("INVITE")) { if(!t_is_set("failure_route")) t_on_failure("MANAGE_FAILURE"); } if (!t_relay()) { sl_reply_error(); } exit; } # jsonrpc dispatch event_route[xhttp:request] { if ($hu =~ "^/RPC") { jsonrpc_dispatch(); } else { xhttp_reply("200", "OK", "text/html", "<html><body>Wrong URL $hu</body></html>"); } }

1 1

limits in hashtable
by Fabian Borot 10 Mar '21

10 Mar '21

Hi I have a hashtable with about 2500 elements in it. Some of the key_names are the same and in the config file and I traverse them using the index. The problem that I am having is that not all the values are loaded into memory. Lets say I have 5 entries with key_name and key_values like this: 1.2.34:5060:10.10.10 --> 0001232555690 1.2.34:5060:10.10.10 --> 0004562555691 1.2.34:5060:10.10.10 --> 0007892555692 1.2.34:5060:10.10.10 --> 0003212555693 1.2.34:5060:10.10.10 --> 0006542555694 when I do this kamcmd htable.get mytable 1.2.34:5060:10.10.10[0] kamcmd htable.get mytable 1.2.34:5060:10.10.10[1] kamcmd htable.get mytable 1.2.34:5060:10.10.10[2] kamcmd htable.get mytable 1.2.34:5060:10.10.10[3] kamcmd htable.get mytable 1.2.34:5060:10.10.10[4] I am supposed to get their values on the console but sometimes I can not get the 3rd or 4th value , instead I receive this error error: 500 - Key name doesn't exist in htable. What I have been doing so far is to delete extra/old keys from the physical hashtable and load the values again and then it works for a few days. But there is a process that adds entries to the hashtable and at some point it breaks again and I have to delete again old/unused ones. I can not use 'expire' here because the time it takes to become "old" is unknown/variable. This is how the table is defined..2^16 is more than enough to hold 2500 values. What am I missing here? modparam("htable", "htable", "a=>size=16;autoexpire=0;dbtable=htable;") I have taken pcap captures between the kamailio server and the db and I see all the values being transferred over the network when the kamailio is loading/refreshing the values from the db. Is there another limit somewhere? Also when I try to dump the values I get 'reply too big'. modparam("ctl", "binrpc_max_body_size", 10240) modparam("ctl", "binrpc_struct_max_body_size",10240) ./kamcmd htable.dump a ERROR: reply too big any assistance is highly appreciated fborot

3 2

Can't show single location via kamctl
by Jon Bonilla (Manwe) 09 Mar '21

09 Mar '21

Hi all Using version 5.4.x here. I save the registrations with use_domain 0 but I do use the domain module to do some checks. If I execute "kamctl ul" show I can see the registrations but if I execute "kamctl ul show username" I get "ERROR: domain unknown: use usernames with domain or set default domain in SIP_DOMAIN" I understand I should use domain in case I was using it in the usrloc module but I'm not. How can I tell kamctl not to ask for domain? cheers, Jonm -- PekePBX, the multitenant PBX solution https://pekepbx.com

2 4

Route - loose_route
by Ilie Soltanici 09 Mar '21

09 Mar '21

Hello, I have a strange issue here with the Route header not been respected by the Kamailio server. I'm getting the INVITE from the SBC-1, adding my own RR header (SBC-2), and send it to the SBC-3 This is the Invite I'm sending outside to the SBC-3 Proxy. ``` INVITE sip:+123456789@192.168.1.1:5060 SIP/2.0 Record-Route: <sip:SBC-2:5067;transport=tls;r2=on;ftag=as2b53df6f;lr> Record-Route: <sip:SBC-1;ftag=as2b53df6f;lr> ``` I'm getting back 200OK with mirrored RR, the call is established successfully. But, the problem is with the BYE message coming from the SBC-3: ``` BYE sip:+123456789@192.168.1.2:5060 SIP/2.0 ROUTE: <sip:SBC-2:5067;transport=tls;r2=on;ftag=as2b53df6f;lr>,<sip:SBC-1;ftag=as2b53df6f;lr> ``` There are 2 routes within a single header. Afaik, loose_function should remove his own Route header (SBC-2) and forward the message to the next Route (SBC-1), or to the URI if there are not other Routes. But, in my case, for some reason Kamailio on SBC-2 is sending the request directly to the URI, bypassing the SBC-1. In the logs I'm getting the following errors: *rr_do_force_send_socket(): no socket found to match second RR (sip:SBC-1)* *rr_do_force_send_socket(): second RR uri is not myself (sip:SBC-1)* To enforce the socket I was trying to use 'sn=interface', then I'm not getting anymore this error - but still, Kamailio sends the message directly to the URI, instead of SBC-1. Is there anything wrong with my config, or I am missing something with the Route headers? Kamailio Version: version: kamailio 5.4.4 (x86_64/linux) bdf4e0 Thank you.

2 1

Lookup issue with websockets contacts
by moisesynfante 09 Mar '21

09 Mar '21

I have configured Kamailio for websockets support and I'm having issues whenever I try to lookup a WS registered uac on the location table, it never finds the contact even though the contact is present when I dump the list via kamcmd. This issue only happens with WS, I tested using another user agent with a different protocol and it works fine, not sure if this is related to the fact that WS RURI doesn't really contain the AoR username. The AoR is something like 104-p4f578, but the contact's address stored is something like: sip:f0ck9vph@sjm8i3la4i7n.invalid;transport=ws; -- Sent from: http://sip-router.1086192.n5.nabble.com/Users-f3.html

2 1

TLS certificate unknown
by Daniel Hermann N'don 09 Mar '21

09 Mar '21

Hi guys, I am a beginner in kamailio technology. I want to use kamailio in secure mode with TLS. But when I try to connect via TLS, I get this error in terminal: Mar 08 12:29:36 KAMAILIO5 /usr/sbin/kamailio[1627]: ERROR: <core> [core/tcp_read.c:1512]: tcp_read_req(): ERROR: tcp_read_req: error reading - c: 0x7f6d71a82800 r: 0x7f6d71a828e8 (-1) Mar 08 12:29:44 KAMAILIO5 /usr/sbin/kamailio[1629]: ERROR: tls [tls_util.h:42]: tls_err_ret(): TLS accept:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown tls.cfg : [server:default] method = TLSv1.2+ verify_certificate = no require_certificate = no private_key = /etc/certs/kamailio/kamailio-key.pem certificate = /etc/certs/kamailio/kamailio-cert.pem ca_list = /etc/certs/demoCA/kamailio-cert.pem I followed this tutorial to generate the ssl keys: http://www.kamailio.net/dokuwiki/doku.php/tls:create-certificates Can someone please help me?

2 1

client TLS session reuse problem
by Rupesh Kumar 09 Mar '21

09 Mar '21

Hi, I am running kamailio 5.2.6 on centos 8 and openssl 1.1.1c and connecting and using it as a proxy sip endpoints to a legacy PBX over TLS. The connection to the backend PBX is over TLS 1.2 . Whenever kamailio initiates a TLS connection to the PBX, it uses session ID and a random session id . The server side has a bug and cannot handle the TLS session resuse apparently because of some bug/issue in caching the TLS sessions. The renegotiation and session_cache is by default turned off and I also explicitly set to 0 via modparam but kamailio would always send the session ID in the initial client hello and this is causing us trouble. Any help would be greatly appreciated. https://kamailio.org/docs/modules/5.2.x/modules/tls.html#tls.p.renegotiation Regards, RK

2 2

Core dumps/crash handlers
by Alex Balashov 09 Mar '21

09 Mar '21

For memory bugs like this ... [mem/f_malloc.c:599]: fm_free(): BUG: fm_free: bad pointer 0x1 (out of memory block!), called from tm: h_table.c: free_cell_helper(185) - aborting ... I'd love to see a core dump, but unfortunately the SIGCHLD from the SIGABRT-terminated child is intercepted and leads to a graceful shutdown: [main.c:743]: handle_sigs(): child process 16037 exited by a signal 6 Is there any way Kamailio can be set to dump core when this happens? -- Alex Balashov | Principal | Evariste Systems LLC Tel: +1-706-510-6800 / +1-800-250-5920 (toll-free) Web: http://www.evaristesys.com/, http://www.csrpswitch.com/

2 1

monitor uac registration status
by Davide Zanichelli 05 Mar '21

05 Mar '21

Hello is there a way to monitor (write to db) uacreg status ? Thanks You Davide

3 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

sr-users March 2021